Generate a random URL with Python using App Engine

Question

I know there have been a number of questions asked and answered on Stackoverflow around this topic but I am hoping that as this question requires some additional information, it warrants its own space or might be useful for others.

I have a web app running on app engine using Python and I want to be able to send unique URLs to users and limit the ability for another user to guess a url based off the url they receive. I would prefer that users don't need to be authenticated to view the data associated with the url.

My question is around the best way to create, possibly check and store the urls. One option could be to use uuid.uuid4() and store this value in the data model to retrieve the information. I could use uuid.uuid5 and use the key_value from the datastore, I could also base64 encode each option or could I possibly simply use the datastore key_value ?

Whichever method I choose, will it be unique so I don't need to check if the url already exists in the datastore or is it prudent to do check if it has been generated previously?

The final question is should I store the url in the datastore or use a function to map the url back to existing data in the datastore.

So to summarise:

1. What method do you recommend I use to create the URL and why
2. Is it prudent to check if the url has been created previously
3. Should I store the URL in the datastore or use a function to map it back

Thanks

Answer 1

1. A big enough random string should be good enough, because the probability of collision would be minimal. I guess you could also use the automatic Key from the Datastore, because they are guaranteed to be unique.

2. I don't think that would be necessary if you follow 1.

3. I would make an Entity in the datastore that maps urls to what you want to serve, not through a hash function. That way you will have a better control on what objects you want to make public and what you want to keep private. And if you see that one url goes public you will be able to change it easily.

If what you want to serve is on Cloud Storage you can try Signed URLs 1 .

---